CVE-2007-6600: Medium severity PostgreSQL postgresql vulnerability
Any logged-in database user who has the ability to create tables and functions (which in most installations will be everybody) can acquire database superuser privilege, which means he can make the server process do whatever he wants.
Other sources
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2007-6600?
CVE-2007-6600 is classified as a medium severity vulnerability affecting PostgreSQL versions before 8.2.6.
How do I fix CVE-2007-6600?
To fix CVE-2007-6600, upgrade PostgreSQL to versions 7.4.19, 8.1.11, or 8.2.6 or later.
Which PostgreSQL versions are affected by CVE-2007-6600?
CVE-2007-6600 affects PostgreSQL versions 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21.
What specifically does CVE-2007-6600 impact in PostgreSQL?
CVE-2007-6600 impacts the use of superuser privileges instead of table owner privileges for VACUUM and ANALYZE operations.
Are there any known exploits for CVE-2007-6600?
There is no publicly available information indicating that CVE-2007-6600 has been actively exploited.